> ## Documentation Index
> Fetch the complete documentation index at: https://tally.wharflab.com/llms.txt
> Use this file to discover all available pages before exploring further.

# tally/gpu/no-redundant-cuda-install

> CUDA packages are already provided by the nvidia/cuda base image.

CUDA packages are already provided by the nvidia/cuda base image.

| Property | Value       |
| -------- | ----------- |
| Severity | Warning     |
| Category | Correctness |
| Default  | Enabled     |
| Auto-fix | No          |

## Description

Detects `RUN` instructions that install CUDA userspace packages via a package manager
(`apt`, `apt-get`, `yum`, `dnf`, `microdnf`, `apk`) in stages that already inherit from
`nvidia/cuda:*`.

The rule is **flavor-aware**: it parses the image tag to determine the variant (`base`,
`runtime`, or `devel`) and only flags packages that the variant already includes. For
example, installing `cuda-toolkit` on a `runtime` image is legitimate (runtime does not
include the toolkit), but installing `cuda-runtime` on a `runtime` image is redundant.

## Why this matters

* **Redundant work** -- the base image already provides the CUDA stack for the selected variant
* **Version drift** -- the package manager may install a different CUDA version than the one
  baked into the base image, causing subtle incompatibilities
* **Image bloat** -- duplicate CUDA libraries waste space in the image layers
* **Maintenance burden** -- two sources of truth for the CUDA version make upgrades harder

## Examples

### Violation

```dockerfile theme={null}
# devel includes the full toolkit -- reinstalling is redundant
FROM nvidia/cuda:12.2.0-devel-ubuntu22.04
RUN apt-get update && apt-get install -y cuda-toolkit
```

```dockerfile theme={null}
# cudnn tag already includes cuDNN -- reinstalling is redundant
FROM nvidia/cuda:12.2.0-cudnn-devel-ubuntu22.04
RUN apt-get update && apt-get install -y libcudnn8
```

```dockerfile theme={null}
# runtime includes cuda-runtime -- reinstalling is redundant
FROM nvidia/cuda:12.2.0-runtime-centos7
RUN yum install -y cuda-runtime-12-2
```

### No violation

```dockerfile theme={null}
# runtime does NOT include the toolkit -- this install is legitimate
FROM nvidia/cuda:12.2.0-runtime-ubuntu22.04
RUN apt-get update && apt-get install -y cuda-toolkit
```

```dockerfile theme={null}
# nvidia/cuda base with application packages only
FROM nvidia/cuda:12.2.0-runtime-ubuntu22.04
RUN apt-get update && apt-get install -y python3 python3-pip
```

```dockerfile theme={null}
# Non-nvidia/cuda base -- intentional CUDA install is not flagged
FROM ubuntu:22.04
RUN apt-get update && apt-get install -y nvidia-cuda-toolkit
```

## Flavor-aware matching

The rule maps packages to the nvidia/cuda image variant that includes them:

| Package                                            | Included in          | Match type   |
| -------------------------------------------------- | -------------------- | ------------ |
| `cuda`, `cuda-runtime`                             | base, runtime, devel | Exact        |
| `cuda-runtime-*`, `cuda-compat-*`                  | base, runtime, devel | Prefix       |
| `cuda-libraries`, `cuda-libraries-*`               | runtime, devel       | Exact/Prefix |
| `nvidia-cuda-toolkit`, `cuda-toolkit`, `cuda-nvcc` | devel                | Exact        |
| `cuda-toolkit-*`, `cuda-nvcc-*`                    | devel                | Prefix       |
| `libcudnn*`                                        | cudnn tags only      | Prefix       |

TensorRT packages (`tensorrt*`) are never flagged because standard `nvidia/cuda` tags do
not include TensorRT.

When the tag cannot be parsed (e.g., digest-only or ARG-based), the rule defaults to
`devel` to avoid false positives.

## Applicability

This rule only fires on stages where the base image is `nvidia/cuda:*` (or `docker.io/nvidia/cuda:*`).
It does **not** fire on:

* Stages with a non-NVIDIA base image (e.g., `ubuntu:22.04`)
* Stages using other NVIDIA images (e.g., `nvcr.io/nvidia/pytorch:*`, `nvidia/cudagl:*`)
* Stages that reference another build stage (`FROM builder`)

## Configuration

This rule has no rule-specific options.

```toml theme={null}
[rules.tally.gpu.no-redundant-cuda-install]
severity = "warning"
```

## References

* [NVIDIA CUDA Docker Hub](https://hub.docker.com/r/nvidia/cuda/)
* [NVIDIA CUDA image variants](https://gitlab.com/nvidia/container-images/cuda/blob/master/doc/supported-tags.md)